Skip to content
AgentSwap Docs
docs/security/trust-model

Trust Model

AgentSwap Intents is designed to eliminate centralized trust. The IntentSettlerV1 protocol enforces intent strictly through structure rather than authority.

There is no contract owner, no administrator, no pause capability, no upgrade path, no allowlist, no external oracle, no escrow and no sweep function. No party holds user funds across transactions: within a single fill the settler and then the solver hold the input, and both positions vanish with the transaction if it does not deliver.

Safety is entirely structural: a transaction either delivers at least the signed floor to the order’s recipient — which the owner chose and need not be the owner — or it reverts entirely.

Immutability as a Requirement

Section titled “Immutability as a Requirement”

The settler contract is intentionally non-upgradeable.

This immutability is a strict security requirement. The Permit2 contract verifies the signer of an intent but explicitly allows the signed spender (the settler) to choose the exact recipient of the pulled funds at execution time. If the settler were an upgradeable proxy, an admin could upgrade the logic behind the proxy and redirect funds that had already been authorized by users under the previous bytecode.

By being immutable, the user can trust that the logic they authorize today will be the exact logic executed tomorrow.

External Trust Anchors

Section titled “External Trust Anchors”

Because the protocol minimizes its own authority, the remaining trust is deferred to the foundational infrastructure of the EVM:

  • Permit2: The canonical Uniswap Permit2 contract is trusted for signature verification, nonce consumption, and token pull authorization.
  • ERC-20 Standards: Tokens are trusted to behave according to the standard balance-stable ERC-20 model.
  • EVM Atomicity: The chain is trusted to execute transactions atomically and to support EIP-1153 transient storage, which the settler’s reentrancy guard uses.
  • The User: The user is ultimately responsible for choosing safe tokens, setting reasonable deadlines, and signing an economically sound curve.

Solvers, fillers, routers, relayers, frontends, and indexers are trusted with nothing that survives a reverted transaction. They have no custody over user assets, and their failure or malice cannot violate the signed invariants.